The Internet (and related networks) can be used to send e-mails, conduct business, automate machinery and data processing. Connected users can use the Internet to interact with other connected users and/or connected computer systems. Some of the Internet traffic is wanted by the parties involved, but other traffic is unwanted by at least one party. For example, by some estimates, more than three quarters of daily e-mail volume over the Internet is unwanted by its targeted recipient (sometimes referred to as “spam”). More than just e-mail traffic is unwanted by its targeted recipient. For example, banks, bank customers, and bank network operators and managers do not want traffic that is attempting to manipulate the bank's online banking system to facilitate fraud. Of course, in today's world, there is some traffic that is wanted and/or necessary, so one task that online systems operators have to deal with is separating the wanted traffic from the unwanted traffic, letting the wanted traffic through and blocking the unwanted traffic.
For example, the typical e-mail recipient does not want to receive all unsolicited commercial offers. The online network operator that limits access to resources to authorized users does not want to receive traffic from unauthorized users. Unfortunately, the initiators of such unwanted traffic really want to send it, and will attempt to do so even if it requires getting around limits and controls placed by the online network operator. This creates an “arms race” between the initiators of unwanted traffic and the online network/systems operator.
There are many reasons a sender of unwanted traffic might want to initiate the traffic. Often, those are financial reasons. For example, if a scammer can send out one million e-mails with a total expenditure of less than ten dollars and a half hour of time, and reap a few dollars in profits from just 0.01% of the e-mail recipients, it is cost-effective for the scammer to do so. If an criminal organization can apply 100,000 username-password pairs to an e-commerce website to find the 0.01% that are vulnerable, they would do so if the monetary returns from hacking ten user accounts is greater than the cost to the criminal organization of obtaining the username-password pairs plus the cost of executing 100,000 attempted logins.
These unwanted attacks could be thwarted using guaranteed secure methods to filter out unwanted/unauthorized traffic from wanted/authorized traffic. However, as illustrated from the examples above, even a 99.99% success rate at blocking attacks would still allow enough traffic through to be a cost-effective attack. Some of this economics comes about because automation lowers the cost of transactions. Ironically, the very automation that makes it economically feasible for a bank, retailer, music distributor, online storage vendor, etc. to provide a low-cost service to millions of its customers also makes it economically feasible for a criminal or criminal organization to make millions of attempts to get at network resources in an unauthorized way.
If the effort required to mount an attack on a network resource can be raised so that it is uneconomical to attack (but still easy enough for authorized users to access), the attacks might be reduced. Therefore, it would be desirable to increase the efforts/costs of access to the network resource in a way that makes it uneconomical for an organization to mount an attack on network resources, while allowing authorized uses.